*docs* Disable iptables/ip6tables/arptables for bridged packets when we
        bring up a xen bridge. (#177794)
    You can still restrict access to dom0 from domU via the normal IP-based
        mechanisms, and all packets are passed to domU for domU to filter.
    Now, if you want to have dom0 firewalling domU, or you want to actually do
        filtering on the bridge based on specific bridge ports (with the
        physdev module), you'll have to turn this back on. But in those cases,
        you're almost certainly writing your own firewall rules by hand
        anyways.